www-is-ilkbaharcekilisi-tc.com Open in urlscan Pro
160.153.199.11 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www-is-ilkbaharcekilisi-tc.com/is/
Submission Tags: 6413965
Submission: On February 22 via api (February 22nd 2020, 11:02:52 pm UTC) from NL

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 160.153.199.11, located in Scottsdale, United States and belongs to GODADDY-AMS, DE. The main domain is www-is-ilkbaharcekilisi-tc.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on February 21st 2020. Valid for: 2 years.

This is the only time www-is-ilkbaharcekilisi-tc.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Isbank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 11	160.153.199.11 160.153.199.11		21501 (GODADDY-AMS) (GODADDY-AMS)
10	1

11 160.153.199.11 (Scottsdale, United States) 1 redirects

ASN21501 (GODADDY-AMS, DE)
PTR: ip-160-153-199-11.ip.secureserver.net

www-is-ilkbaharcekilisi-tc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	www-is-ilkbaharcekilisi-tc.com 1 redirects www-is-ilkbaharcekilisi-tc.com	147 KB
10	1

	Domain	Requested by
11	www-is-ilkbaharcekilisi-tc.com	1 redirects www-is-ilkbaharcekilisi-tc.com
10	1

This site contains no links.

Subject Issuer	Validity	Valid
www-is-ilkbaharcekilisi-tc.com Go Daddy Secure Certificate Authority - G2	`2020-02-21` - `2022-02-21`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://www-is-ilkbaharcekilisi-tc.com/is/
Frame ID: 40B598BD5E87B8F2B51BA7E7CA7A3D96
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www-is-ilkbaharcekilisi-tc.com/is HTTP 301
https://www-is-ilkbaharcekilisi-tc.com/is/ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

147 kB
Transfer

308 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www-is-ilkbaharcekilisi-tc.com/is HTTP 301
https://www-is-ilkbaharcekilisi-tc.com/is/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www-is-ilkbaharcekilisi-tc.com/is/ Redirect Chain https://www-is-ilkbaharcekilisi-tc.com/is https://www-is-ilkbaharcekilisi-tc.com/is/	1 KB 751 B	132ms 132ms	Document text/html	160.153.199.11 GODADDY-AMS
General Check archive.org Show headers Download Go to Full URL https://www-is-ilkbaharcekilisi-tc.com/is/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 160.153.199.11 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE), Reverse DNS ip-160-153-199-11.ip.secureserver.net Software Apache / PHP/5.6.40 Resource Hash `93189acec9dcee446ed3a1323bbb72e443d3706a8feb79aae0da4f3274bfd4e4` Request headers :method GET :authority www-is-ilkbaharcekilisi-tc.com :scheme https :path /is/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 sec-fetch-dest document accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Sec-Fetch-Dest document Response headers status 200 date Sat, 22 Feb 2020 23:02:36 GMT server Apache x-powered-by PHP/5.6.40 vary Accept-Encoding,User-Agent content-encoding gzip content-length 658 content-type text/html; charset=UTF-8 Redirect headers status 301 date Sat, 22 Feb 2020 23:02:36 GMT server Apache location https://www-is-ilkbaharcekilisi-tc.com/is/ content-length 250 content-type text/html; charset=iso-8859-1
GET H2	200	style.css www-is-ilkbaharcekilisi-tc.com/is/fonts/linearicons/	8 KB 2 KB	129ms 126ms	Stylesheet text/css	160.153.199.11 GODADDY-AMS
General Check archive.org Show headers Download Go to Full URL https://www-is-ilkbaharcekilisi-tc.com/is/fonts/linearicons/style.css Requested by Host: www-is-ilkbaharcekilisi-tc.com URL: https://www-is-ilkbaharcekilisi-tc.com/is/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 160.153.199.11 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE), Reverse DNS ip-160-153-199-11.ip.secureserver.net Software Apache / Resource Hash `f5c203b6416a054de195921e85165e4d66fd303ea8d20982a190fede7b673576` Request headers Referer https://www-is-ilkbaharcekilisi-tc.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Sec-Fetch-Dest style Response headers date Sat, 22 Feb 2020 23:02:36 GMT content-encoding gzip last-modified Sat, 23 May 2015 21:22:14 GMT server Apache etag "102c24-2098-516c65ed66d80-gzip" vary Accept-Encoding,User-Agent content-type text/css status 200 accept-ranges bytes content-length 1651
GET H2	200	style.css www-is-ilkbaharcekilisi-tc.com/is/css/	4 KB 1 KB	129ms 126ms	Stylesheet text/css	160.153.199.11 GODADDY-AMS
General Check archive.org Show headers Download Go to Full URL https://www-is-ilkbaharcekilisi-tc.com/is/css/style.css Requested by Host: www-is-ilkbaharcekilisi-tc.com URL: https://www-is-ilkbaharcekilisi-tc.com/is/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 160.153.199.11 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE), Reverse DNS ip-160-153-199-11.ip.secureserver.net Software Apache / Resource Hash `8c4362ccba965940c4193866b1698ff8fbd80351ba2bab282d6d7964b6089b87` Request headers Referer https://www-is-ilkbaharcekilisi-tc.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Sec-Fetch-Dest style Response headers date Sat, 22 Feb 2020 23:02:36 GMT content-encoding gzip last-modified Sat, 26 Oct 2019 05:37:42 GMT server Apache etag "102c17-115c-595c9aa51b580-gzip" vary Accept-Encoding,User-Agent content-type text/css status 200 accept-ranges bytes content-length 1187
GET H2	404	image-1.png www-is-ilkbaharcekilisi-tc.com/is/images/	338 B 338 B	130ms 127ms	Image text/html	160.153.199.11 GODADDY-AMS
General Check archive.org Show headers Download Go to Show image Full URL https://www-is-ilkbaharcekilisi-tc.com/is/images/image-1.png Requested by Host: www-is-ilkbaharcekilisi-tc.com URL: https://www-is-ilkbaharcekilisi-tc.com/is/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 160.153.199.11 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE), Reverse DNS ip-160-153-199-11.ip.secureserver.net Software Apache / Resource Hash `84b059b126266c386732ba964dfee785dc1330b4fd7c1ac828be3f97516e03e3` Request headers Referer https://www-is-ilkbaharcekilisi-tc.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Sec-Fetch-Dest image Response headers status 404 date Sat, 22 Feb 2020 23:02:36 GMT server Apache content-length 338 content-type text/html; charset=iso-8859-1
GET H2	200	cca.png www-is-ilkbaharcekilisi-tc.com/is/images/	4 KB 5 KB	130ms 127ms	Image image/png	160.153.199.11 GODADDY-AMS
General Check archive.org Show headers Download Go to Show image Full URL https://www-is-ilkbaharcekilisi-tc.com/is/images/cca.png Requested by Host: www-is-ilkbaharcekilisi-tc.com URL: https://www-is-ilkbaharcekilisi-tc.com/is/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 160.153.199.11 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE), Reverse DNS ip-160-153-199-11.ip.secureserver.net Software Apache / Resource Hash `f5ffebf4a0848858fc42bcb2de700a20b26b408613ef4ef0f61f54525d95c462` Request headers Referer https://www-is-ilkbaharcekilisi-tc.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Sec-Fetch-Dest image Response headers date Sat, 22 Feb 2020 23:02:36 GMT last-modified Tue, 29 Oct 2019 04:03:56 GMT server Apache etag "102c2a-11b9-59604b481e300" content-type image/png status 200 accept-ranges bytes content-length 4537
GET H2	200	jquery-3.3.1.min.js Show response www-is-ilkbaharcekilisi-tc.com/is/js/	85 KB 30 KB	133ms 131ms	Script application/javascript	160.153.199.11 GODADDY-AMS
General Check archive.org Show headers Download Go to Full URL https://www-is-ilkbaharcekilisi-tc.com/is/js/jquery-3.3.1.min.js Requested by Host: www-is-ilkbaharcekilisi-tc.com URL: https://www-is-ilkbaharcekilisi-tc.com/is/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 160.153.199.11 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE), Reverse DNS ip-160-153-199-11.ip.secureserver.net Software Apache / Resource Hash `4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de` Request headers Referer https://www-is-ilkbaharcekilisi-tc.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Sec-Fetch-Dest script Response headers date Sat, 22 Feb 2020 23:02:36 GMT content-encoding gzip last-modified Fri, 27 Jul 2018 11:39:56 GMT server Apache etag "102c31-15391-571f992213b00-gzip" vary Accept-Encoding,User-Agent content-type application/javascript status 200 accept-ranges bytes content-length 30313
GET H2	200	main.js Show response www-is-ilkbaharcekilisi-tc.com/is/js/	0 99 B	129ms 127ms	Script application/javascript	160.153.199.11 GODADDY-AMS
General Check archive.org Show headers Download Go to Full URL https://www-is-ilkbaharcekilisi-tc.com/is/js/main.js Requested by Host: www-is-ilkbaharcekilisi-tc.com URL: https://www-is-ilkbaharcekilisi-tc.com/is/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 160.153.199.11 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE), Reverse DNS ip-160-153-199-11.ip.secureserver.net Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://www-is-ilkbaharcekilisi-tc.com/is/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Sec-Fetch-Dest script Response headers date Sat, 22 Feb 2020 23:02:36 GMT last-modified Fri, 14 Sep 2018 13:00:40 GMT server Apache etag "102c32-0-575d469142e00" vary User-Agent content-type application/javascript status 200 accept-ranges bytes content-length 0
GET H2	200	Muli-SemiBold.ttf www-is-ilkbaharcekilisi-tc.com/is/fonts/muli/	91 KB 43 KB	228ms 228ms	Font font/ttf	160.153.199.11 GODADDY-AMS
General Check archive.org Show headers Download Go to Full URL https://www-is-ilkbaharcekilisi-tc.com/is/fonts/muli/Muli-SemiBold.ttf Requested by Host: www-is-ilkbaharcekilisi-tc.com URL: https://www-is-ilkbaharcekilisi-tc.com/is/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 160.153.199.11 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE), Reverse DNS ip-160-153-199-11.ip.secureserver.net Software Apache / Resource Hash `1fd89d993352d472a95d39a265445be9994defb20b2d6af8973bcfff4ec796b7` Request headers Referer https://www-is-ilkbaharcekilisi-tc.com/is/css/style.css Origin https://www-is-ilkbaharcekilisi-tc.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Response headers date Sat, 22 Feb 2020 23:02:36 GMT content-encoding gzip last-modified Wed, 25 May 2011 03:00:00 GMT server Apache etag "102c28-16de8-4a410e6798c00-gzip" vary Accept-Encoding,User-Agent content-type font/ttf status 200 accept-ranges bytes content-length 43854
GET H2	200	Linearicons-Free.woff2 www-is-ilkbaharcekilisi-tc.com/is/fonts/linearicons/fonts/	21 KB 22 KB	163ms 162ms	Font font/woff2	160.153.199.11 GODADDY-AMS
General Check archive.org Show headers Download Go to Full URL https://www-is-ilkbaharcekilisi-tc.com/is/fonts/linearicons/fonts/Linearicons-Free.woff2?w118d Requested by Host: www-is-ilkbaharcekilisi-tc.com URL: https://www-is-ilkbaharcekilisi-tc.com/is/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 160.153.199.11 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE), Reverse DNS ip-160-153-199-11.ip.secureserver.net Software Apache / Resource Hash `296945e5922e764eef17b1b4a3ee3e60dc202b3c7f074150b62158915bf74e33` Request headers Referer https://www-is-ilkbaharcekilisi-tc.com/is/fonts/linearicons/style.css Origin https://www-is-ilkbaharcekilisi-tc.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Response headers date Sat, 22 Feb 2020 23:02:36 GMT content-encoding gzip last-modified Sun, 24 May 2015 11:30:36 GMT server Apache etag "102c21-5514-516d238d54f00-gzip" vary Accept-Encoding,User-Agent content-type font/woff2 status 200 accept-ranges bytes content-length 21803
GET H2	200	Muli-Regular.ttf www-is-ilkbaharcekilisi-tc.com/is/fonts/muli/	92 KB 43 KB	286ms 285ms	Font font/ttf	160.153.199.11 GODADDY-AMS
General Check archive.org Show headers Download Go to Full URL https://www-is-ilkbaharcekilisi-tc.com/is/fonts/muli/Muli-Regular.ttf Requested by Host: www-is-ilkbaharcekilisi-tc.com URL: https://www-is-ilkbaharcekilisi-tc.com/is/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 160.153.199.11 Scottsdale, United States, ASN21501 (GODADDY-AMS, DE), Reverse DNS ip-160-153-199-11.ip.secureserver.net Software Apache / Resource Hash `6b77c0a3d0a163dd173ccf8d4cbe4d19d63f108b8fba52a854cc666d9663a4bf` Request headers Referer https://www-is-ilkbaharcekilisi-tc.com/is/css/style.css Origin https://www-is-ilkbaharcekilisi-tc.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50 Response headers date Sat, 22 Feb 2020 23:02:36 GMT content-encoding gzip last-modified Wed, 25 May 2011 03:00:00 GMT server Apache etag "102c27-17070-4a410e6798c00-gzip" vary Accept-Encoding,User-Agent content-type font/ttf status 200 accept-ranges bytes content-length 43978

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Isbank (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

www-is-ilkbaharcekilisi-tc.com
160.153.199.11
1fd89d993352d472a95d39a265445be9994defb20b2d6af8973bcfff4ec796b7
296945e5922e764eef17b1b4a3ee3e60dc202b3c7f074150b62158915bf74e33
4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de
6b77c0a3d0a163dd173ccf8d4cbe4d19d63f108b8fba52a854cc666d9663a4bf
84b059b126266c386732ba964dfee785dc1330b4fd7c1ac828be3f97516e03e3
8c4362ccba965940c4193866b1698ff8fbd80351ba2bab282d6d7964b6089b87
93189acec9dcee446ed3a1323bbb72e443d3706a8feb79aae0da4f3274bfd4e4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f5c203b6416a054de195921e85165e4d66fd303ea8d20982a190fede7b673576
f5ffebf4a0848858fc42bcb2de700a20b26b408613ef4ef0f61f54525d95c462

www-is-ilkbaharcekilisi-tc.com Open in urlscan Pro 160.153.199.11 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

147 kBTransfer

308 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

www-is-ilkbaharcekilisi-tc.com Open in urlscan Pro
160.153.199.11 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

147 kB
Transfer

308 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!